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In January 2004, the National Aeronautics and Space Administration (NASA) was given a vision for Space 
Exploration by President Bush, setting our sight on a bold new path to go back to the Moon, then to Mars 
and beyond. As NASA gets ready to meet the vision set by President Bush, failures are not an option. 
Reliability of the propulsion engine systems will play an important role in establishing an overall safe and 
reliable operation of these new space systems. A new standard, NASA-STD-5012, Strength and Life 
Assessment for Space Propulsion System Engines, has been developed to provide structural requirements for 
assessment of the propulsion systems engine. This standard is a complement to the current NASA-wide 
standard NASA-STD-5001, Structural Design and Test Factors of Safety for Spaceflight Hardware, which 
excluded the requirement for the engine systems (rotatory structures) along with pressure vessels. As 
developed, this document builds on the heritage of the multiple industrial standards related to strength and 
life assessment of the structures. For assuring a safe and reliable operation of a product and/or mission, 
establishing a set of structural assessment requirements is a key ingredient. Hence, a concentrated effort was 
made to improve the requirements where there are known lessons learned during the design, test, and 
operation phases of the Space Shuttle Main Engine (SSME) and other engine development programs. 
Requirements delineated in this standard are also applicable for the reusable and/or human missions. It shall 
be noted that “reliability of a system cannot be tested and inspected but can only be achieved if it is first 
designed into a system.” Hence, these strength and life assessment requirements for the space propulsion 
system engines shall be used along with other good engineering practices, requirements, and policies. 


Introduction 

NASA has a very well-defined program and process to develop a set of standards for use in design, development, 
and certification of flight hardware. This was necessitated to provide uniformity across NASA centers and in 
response to the federal law 1 which requires the use of industry standards, where available. 

In response to this standard’s development activity, a new standard for Structural Strength Requirement, NASA- 
STD-5001 2 , was developed and released. Since the release of this standard, all new programs have been using this 
standard as the first choice for designing new spacecraft and vehicles. However, at the release of this document, 
rotatary hardware (engines) and pressure vessels were not included in the scope of this document. 

As we initiated new propulsion system engine development programs, since the commencement of the new 
standard, NASA-STD-5001, it was noticed that no NASA- wide standard and/or industry standard is available which 
outlines the Strength and Life Assessment Requirements for the Space Propulsion System Engines. Although a 
historical standard, Marshall Space Flight Center’s MSFC-HDBK-505 3 could still be used. It was also realized that 
there are some requirements which need to be enhanced based upon the lessons learned. MSFC-HDBK-505 (and as 
modified by the Prime contractor and accepted per Contract End Item) was primarily used as a basis for the design 
of the SSME. Hence, a request was made and accepted by the NASA Technical Standards Program to develop a 
dedicated Strength and Life Assessment Requirements for the Space Propulsion System Engines. 
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Procedure 
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Design of high-performance engines for space application requires an interaction of multiple inputs as shown in 
Figure 1. A good criteria plays a strong role since operating environments are very harsh (extreme cryogenic or 
high temperatures, high pressures, propellant/material interaction), and there is a need for keeping the low weight for 
maximum payload capacity, etc. 

While developing this standard, the developer took special care to assure that criteria should be concise and based 
upon good engineering judgment (since, a criterion for primary application in space industry should not constrain 
innovation and stifle creativity.) A balance is required to assure reliable mission operation yet be lightweight and 
affordable. Also: 

a. Regardless of popular belief, engineers are human beings; we are prone to make errors. Hence we need 
design margins to guard against the errors. 

b. Objective of the good “structural assessment” is to predict success, not failures. 

c. Engine/Component reliability cannot be analyzed in , it must be designed in. 

Hence, this new standard was developed with the following as its basis: 

1. Use historical requirements, where possible 

2. Incorporate lessons learned, where applicable 

3. Adopt/refer to non-Government voluntary standard (industry) where available and applicable 

As proposed, this standard provides strength and life assessment requirements for all NASA space propulsion 
system engines. Life, as used in this standard, refers to fatigue and creep. In addition, test requirements for 
qualification and verification assessment are specified 


Strength Criteria 

Design safety factors are intended, as listed in popular textbooks, to cover for: 

a. To allow for accidental overloading of structure, as well as for possible inaccuracies in the construction and 
possible unknown variables in analysis of the structure. 

b. Although not commonly used, perhaps a better term for this ratio is factor of ignorance. 

c. A factor of safety is used in the design of structures to allow for (1) uncertainty of loading, (2) the statistical 
variation of material strengths, (3) inaccuracies in geometry and theory, and (4) the grave consequence of failure of 
structures 

Hence, a set of factor of safety are defined. These requirements are mostly based upon the historical requirements 
currently being used and are expressed by reference to other standards. Currently, factor of safety requirements are 
verified using the primary stresses/strains which do not account for secondary stresses/strains (e.g., thermal and/or 
misalignments). Hence, a new requirement for strain to crack initiation margin is being proposed for total loads. 
Having a factor safety requirement for total strain will guard against a design which may result in strain to crack 
initiation. In addition, it is recognized that for some applications, it may be appropriate and necessary to use 
additional design factors such as fitting factors, casting factors, impact factors, etc., in conjunction with the factors 
of safety specified in Table 1. For example: 

a. Brazed, welded, and bonded joints require other special factors consistent with their processing and criticality, but 
shall be at least as severe as those in Table 1. 

b. Margins of safety on performance-driven clearances (for example, in turbo machinery) are generally calculated 
using a safety factor of one. Margins of safety in situations intended to prevent impact, such as an engine fully 
gimbaled, shall use a safety factor of 1.4 at MDC loads, i.e., the clearance must be zero or positive at 1.4 X MDC 
loads. 
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c. The factors in Table 1 shall be used with well-behaved and well-understood materials. For materials not in this 
category, additional factors may be required. For example, titanium alloys have been shown to be susceptible to 
failure near the yield load. For titanium alloys, the maximum peak stress (the total concentrated stress from all 
sources, i.e., MDC loads) shall be less than 80 percent of the material minimum-yield strength. 


Fatigue Criteria 

The requirement established here enhances the requirements in the fatigue analysis area. It shall be recognized that 
the propulsion system is a critical element of the spacecraft system and has been found to be the primary cause of 
failure 5 (Figure 2). 


During the initial design of the SSME, a Fatigue Analysis Factor (FAF) of 1.0 and a Service Life Factor (SLF) of 
4.0 was used. In certain cases, where high-cycle fatigue properties were based upon limited or no data, a SLF of 10 
was used. This resulted in extensive repair, inspection and hardware refurbishment to guard against operation- 
related fatigue cracking noted during the ground test program, and post-flight inspection. Subsequently, as high 
pressure turbopumps were redesigned, fatigue criteria were revised to use a FAF of 1.15 and SLF of 10.0. This 
criterion resulted in a reduced rate of fatigue-related cracking. It is interesting to note that SSME prime contractor, 
Rocketdyne, also realized that fatigue-related criteria needed an enhancement and proposed that for redesign of 
SSME components, a minimum of 500 cycles with a FAF of 1.5 for low-cycle fatigue and a factor of 1.0 on 
endurance with a FAF of 1.25, or equivalent alternate stress, for high-cycle fatigue shall be used as a good design 
practice 6 . 


Similarly, for the Space Transportation Main Engine 7 program a SLF of 10 was proposed to guard against low and 
high-cycle fatigue cracking along with a FAF of 1.15 in 1992. Hence, during the write-up of the proposed 
requirements, a balance was made to strengthen the criteria for rotatory parts of the engines where failures are less 
forgiving and maintain the current requirements for the stationary components but use the service life factor of 10.0 
to reduce the potential of fatigue-related cracking and assure it does not result in weight penalty. 

Hence it is proposed that all structural elements shall be designed and analyzed to demonstrate the following factors: 

(1) A FAF shall be multiplied by the limit stress/strain prior to entering the S-N design curve to determine the 
low-cycle/high-cycle life. The FAF shall be: 

FAF = 1.25 Rotating components 

FAF =1.15 Non-rotating components 


(2) Service Life Factor. The low-cycle factor (LCF) and high-cycle factor (HCF) analyses shall demonstrate a 
minimum calculated life of 10.0 times the service life. 


Test Verification 

Based upon the experience gained during the SSME test verification process and weibayes statistical analysis, it is 
recommended that at least six units be tested for extended duration to assure the reliability of the mission. (Figure 3) 

For multiple units/multiple use propulsion systems, the following criteria needs to be considered in order to establish 
test program requirements: 

a. Reliability for initial mission use requires minimum amount of testing regardless of mission-life requirements 

b. Basic material/load scatter, difficulty in measuring localized strains 

- Reliability for continued engine use requires sustained ground testing 

- Multiple units at or near fleet leader are required 
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Summary 


The purpose of the proposed standard is to provide a consistent set of requirements in the design and assessment of 
space propulsion system engines. As we design/develop new engine systems which use the philosophy of 
minimum-risk. These enhanced requirements should help alleviate the fatigue-related cracking, improve reliability, 
and reduce the redesign and maintenance cost. These requirements are intended to provide strength and life criteria 
in conjunction with other good engineering practices; e.g., attention to details while designing the stress 
concentration areas to avoid sharp radii, specifying appropriate surface finish. Hence, these strength and life 
assessment requirements for the space propulsion system engines shall be used along with other good engineering 
practices, requirements, and policies. 
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Lessons Learned 

External, Independent review teams judging the flight readiness of a vehicle should keep in mind the 
following key lessons gleaned from the past 20 years of space launches: 


1 . Propulsion systems are the primary cause of ail 
launch failures. All propulsion test and checkout 
anomalies/failures demand special attention and 
review. 

2. Hardware built out of normal sequence and 
hardware that has been reworked are major 
causes of failures. The processes, procedures, 
quality inspections, and particularly the re-test 
results demand special review. 

3. There are no small, inconsequential changes in 
flight-critical components or subsystems. Systems 
engineering and every affected technical discipline 
must be involved in the assessment of all new 
systems and their changes. If a change is not 
recertified by test, the rationale must be thoroughly 
examined 


4. Test results that are "in-family,” but near the edge 
of the acceptable envelope, should be thoroughly 
examined. Usually there is a subtle message. 
Always believe test data until they are conclusively 
proved wrong beyond all doubt. 

5. All test anomalies/failures must be thoroughly 
understood and convincingly explained. All 
hardware that is potentially related to an unverified 
system anomaly/failure must be purged from the 
system before launch. 

6. The flight environments and dynamic loads that 
set the qualification and acceptance test levels of 
each flight-critical component must be rigorously 
validated by a continuum of flight measurements 
and analyses. 


% Reliability with 95% confidence 
(Assumption: Weibays distribution, 
no failure) 



0 1 2 3 4 5 6 


# of Units 


First mission of 500 seconds assuming 
each unit has been tested for 30,000 
seconds 

Mission at or near Fleet leader/2 assuming each 
unit has been tested at or near Fleet leader 


Figure 3 
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Table 1 — Minimum Analysis Factors Of Safety And Strength Test Factors 


Engine Hardware Type 

Load 

Mode of 
Failure 

Analysis 
Factor of 
Safety 1 

Test Factors 2 

Qualification 

Acceptance/ 
Proof 3 

Metallic Structures and Components 






Yield 

mechanical only 

net section 

1.10 4 

NA 

NA 

Ultimate 

mechanical only 

net section 

1.40 


NA 

Ultimate 

MDC 

stability 

1.40 

1 


Ultimate-pressure or rotation 

MDP or spin 

net section 

1.50 

■ 


Ultimate 

MDC 

point strain 

2.00 4 

1.40 

1.20 

Pressurized components 






(pressure vessels, lines, fittings, 

MEOP, MDP, or 

MIL-STD-1522 or ANSI/AIAA S-080, ANSI/AIAA S-081, 

fluid return sections and hose, 

MDC as applicable 


AFSPCM AN 91-710 


bellows, etc.) 






Fasteners and Preloaded Joints 






Yield 

MDC 

net section 

1.10 4 

NA 

NA 

Ultimate 

MDC 

net section 

MEEM 

mmm.: 

1.20 

Joint Separation 

MDC 

separation 

aHp 


1.20 

- Safety Critical 7 

MDC 

separation 

MEM 

MUSEUM 

1.20 

Composite and/or bonded 






structures and components - 






ultimate strength 






Uniform areas 

MDC 

point stress 

1.40 

1.40 


Stress concentration areas 

MDC 


2.00 

1.40 


Bonds/joints 

MDC 

point stress 

2.00 

1.40 s 

1.20 5 

Ablatives 

MDC 


1.70 8 

1.40 s ' 8 

1.20 s 

Pressure checkout with 






personnel present 



hHpM 



Yield 

checkout pressure 

Note 9 

■ 

NA 

NA 

Ultimate 

checkout pressure 

Note 9 


NA 

NA 


Notes: 

1. Margins must be written using the specified analysis factor of safety for all the specified loads and modes of 
failure. 

2. Minimum factors which shall be used in the test program to be defined in the SAP for a specific project. 

3. Fracture control may require higher factors if the proof test will be used for flaw screening. 

4. For titanium alloys, the maximum peak stress (the total concentrated stress from all sources, i.e., MDC loads) 
shall be less than 80 percent of the material minimum yield strength. 

5. These tests are always required. 

6. Test pressure = MDP x 1 .20 x ECF > 1.05 x MDP 

Test speed = V (MDC speed 2 x 1.20 ECF) > V (MDC speed 2 x 1.05) 

7. Joints for which separation would be a catastrophic event. 

8. Analysis and test factors apply at end of iife. Qualification test occurs on a hot- fired (fully ablated) fiight-iype 
test article. 

9. Net section for metallic, point stress on ultimate only for composites or adhesive bonds. 
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- Properties scatter 

• Loads 

- Variation 
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3. adopt/refer to non-Government voluntary standard (Industry) where 
available and applicable 
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Rocketdyne Fatigue Criteria 
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An ultimate safety factor of 1.4 on 30-hour stress rupture 
strength at the predicted operating temperature, and a 
factor of 1.0 on 75-hour stress rupture for a 101 increase 
in gas temperature (temperature In Rankine) or 50 degrees, 
whichever is larger 


Fatigue Factor: Why 10 and A-basis material properties? 
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• Fatigue life curve is on Log scale, this masks a lot of variability. 

• “A-Basis” minimum by definition is .99 probability with 95 % confidence. 

• To reach .99999 against failure, a margin against A-basis minimum is a must. 


Causes of Fatigue Problems 
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# of Units 

Hence, Six units are recommended, (also, supported by the SSME test verification process) 



VERIFICATION PROCESS 



-If all these three elements of design verification system are systematically and satisfactory completed, a design is considered to be verified 
and acceptable for service 

-Inspection, post completion of testing, is must for proper verification 

-OSelection of appropriate hardware for testing i.e., represents fleet tolerance is another important factor 
-Test Configuration shall representative of flight configuration 


CONCLUSION 
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capabilitv/reliabilitv of rocket engine hardware. 


SSME Examples of Fatigue life limiting problems 



EXAMPLE: HPFTP/AT Turbine Blade 
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No weight effects. 
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• Increased cost due to the introduction of gold coating late in program. 

• No weight effects. 


EXAMPLE: SSME Nozzle Aft Manifold 






EXAMPLE: Nozzle Stubout Cracking 
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Conclusion: Better design practice, attention to details needed as design modification 


